Claude.ai MCP Connector sends OAuth scope with leading space (` offline_access` instead of `offline_access`)

### MCP server URL

https://a1000-4npocmcp.reversinglabs.com/mcp

### Where does the issue occur?

When pressing the Connect button

### Transport used

streamable-http

### Client registration type

Static

### SSE only: Does your server return the expected status code for POST requests?

Not applicable (my server does not use SSE)

### When did you last reproduce this?

2026-06-12 11:22 UTC

### Browser and OS

Mozilla Firefox for Fedora 151.0.3 (64-bit)

### Describe the issue

When an MCP Connector is configured on [claude.ai/customize/connectors](https://claude.ai/customize/connectors) with `offline_access` in the supported scopes, the OAuth authorization request sent by Claude.ai includes ` offline_access` (with a **leading space**) instead of `offline_access`.

This causes the authorization server to reject the request with `invalid_scope`, and the user sees an error toast on the connectors page. The OAuth flow never completes.

The leading space is visible in:
- The auth callback URL returned to Claude.ai: `error_description=Invalid+scopes%3A++offline_access` (note the double `++` — two spaces)
- The authorization server logs: `reason="Invalid scopes: offline_access"` (note the two spaces before `offline_access`)

The same OAuth parameters work correctly when used from **Claude Code CLI**, confirming the bug is specific to the Web UI MCP Connector.

## Steps to reproduce

1. Set up an OAuth 2.0 authorization server (e.g., Keycloak) with `offline_access` advertised as a supported scope on the well-known endpoint.
2. Define an MCP Connector on [claude.ai/customize/connectors](https://claude.ai/customize/connectors) configured to use this authorization server, with `offline_access` in the requested scopes.
3. Click the **Connect** button for the connector.
4. Observe that an error toast is displayed. The redirect back to Claude.ai contains:
```
https://claude.ai/customize/connectors?&server=&step=end_error&flow_id=&oauth_error=invalid_scope&oauth_error_subtype=provider_redirect
```
5. The auth callback from the authorization server contains:
```
https://claude.ai/api/mcp/auth_callback?error=invalid_scope&error_description=Invalid+scopes%3A++offline_access
```
Note the double space (`++`) before `offline_access` in the URL-encoded error description.

### Issue details

```shell
The error stated in the popup is: Authorization with the MCP server failed. You can check your credentials and permissions. If this persists, share this reference with support: "ofid_a80883879c44efba"
```

### Expected behavior

We expect the client to connect successfully as it does with Claude Code CLI.

### Logs from your server

```shell
Jun 12 11:30:47 INTERNAL_HOSTNAME kc.sh[PID]: 2026-06-12 11:30:47,539 ERROR [org.keycloak.services] (executor-thread-1056) KC-SERVICES0093: Invalid parameter value for: scope
Jun 12 11:30:47 INTERNAL_HOSTNAME kc.sh[PID]: 2026-06-12 11:30:47,539 WARN [org.keycloak.events] (executor-thread-1056) type="LOGIN_ERROR", realmId="REALM_UUID", realmName="REALM", clientId="CLIENT_ID", userId="null", ipAddress="127.0.0.1", error="invalid_request", reason="Invalid scopes: offline_access", response_type="code", redirect_uri="https://claude.ai/api/mcp/auth_callback", response_mode="query"
Jun 12 11:33:07 INTERNAL_HOSTNAME kc.sh[PID]: 2026-06-12 11:33:07,875 ERROR [org.keycloak.services] (executor-thread-1056) KC-SERVICES0093: Invalid parameter value for: scope
Jun 12 11:33:07 INTERNAL_HOSTNAME kc.sh[PID]: 2026-06-12 11:33:07,877 WARN [org.keycloak.events] (executor-thread-1056) type="LOGIN_ERROR", realmId="REALM_UUID", realmName="REALM", clientId="CLIENT_ID", userId="null", ipAddress="127.0.0.1", error="invalid_request", reason="Invalid scopes: offline_access", response_type="code", redirect_uri="https://claude.ai/api/mcp/auth_callback", response_mode="query"
Jun 12 11:45:06 INTERNAL_HOSTNAME kc.sh[PID]: 2026-06-12 11:45:06,469 ERROR [org.keycloak.services] (executor-thread-1056) KC-SERVICES0093: Invalid parameter value for: scope
Jun 12 11:45:06 INTERNAL_HOSTNAME kc.sh[PID]: 2026-06-12 11:45:06,470 WARN [org.keycloak.events] (executor-thread-1056) type="LOGIN_ERROR", realmId="REALM_UUID", realmName="REALM", clientId="CLIENT_ID", userId="null", ipAddress="127.0.0.1", error="invalid_request", reason="Invalid scopes: offline_access", response_type="code", redirect_uri="https://claude.ai/api/mcp/auth_callback", response_mode="query"
```

### Additional context

Removing `offline_access` from the OAuth client's allowed scopes causes the Web UI Connector to complete OAuth successfully (because the malformed scope ` offline_access` is then absent rather than invalid). This workaround disables the `offline_access` feature entirely, which is not a desirable long-term solution.